macOS processes

What is symptomsd on Mac?

symptomsd provides services for Apple's Symptom Framework. Apple documents almost nothing else about it.

Process: symptomsdApplies to: All current macOS versions. Seen on macOS 27.2.Checked: 29 October 2026

Where you see it

  • symptomsd is in the list in Activity Monitor › Network, in nettop or in Kilobat.
  • A firewall or network monitor asks if symptomsd can connect.

What it is

The man page says only that symptomsd “provides services for the Symptom Framework”. It has no options, and users should not run it manually.

Apple publishes no documentation of the Symptom Framework. The program is /usr/libexec/symptomsd.

Why it uses the network

  • Not documented. Apple does not say why symptomsd uses the network. On this Mac, nettop showed no traffic for it.

Is it normal?

It is part of macOS. If it moves a lot of data on your Mac, this is unusual. Measure it with the steps below.

See how much it uses

  1. Open Activity Monitor from Applications > Utilities. Click Network.

  2. Type symptomsd in the search field. The Sent Bytes and Rcvd Bytes columns show what it moved.

  3. In Terminal, watch only this process. Press d to show the change per second, and q to quit.

    nettop -p symptomsd -P

Reduce or pause it safely

  1. There is no user setting for symptomsd.

  2. Do not quit symptomsd in Activity Monitor. It is part of macOS, and other features depend on it.

With Kilobat

  1. Open the Kilobat app list and search for symptomsd. Its row shows the live rate and the bytes it moved.

  2. In Terminal, see the same live list. Press / and type the name to search.

    kilobat status --watch

  3. Show its traffic over one day. Names match kilobat report --summary.

    kilobat bandwidth symptomsd day

  4. Through MCP, an AI agent gets the same history with get_app_bandwidth and the name symptomsd.

  5. The live view is free. History in the app needs Pro. Kilobat records history only while the app runs.

Questions

Is symptomsd malware?

No. It is part of macOS, in /usr/libexec, with a man page.

Sources

  • symptomsd(8), man page installed with macOS 27.2
  • nettop(1), man page installed with macOS 27.2

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with man <name> in Terminal.